The background of a Blow Out Preventer (BOP) will be given with reference to FIG. 1 of the drawings. The Blow Out Preventer (BOP) is a stack of valves. The primary function of the BOP is to open and close the well-bore. For drilling at deep waters with a floating installation (4), or an on-shore remote controlling installation the BOP is mounted on a wellhead (5) at the seafloor during drilling.
The subsea BOP stack of valves, will typically include;                An annular valve that closes the wellbore both when the wellbore is empty and when there is a drill pipe or casing in the drilling riser.        Pipe rams which are valves that close the BOP when there is a drill pipe in the wellbore.        Blind rams that are valves that close the wellbore when there is no drill pipe in the wellbore        Shear rams, which is a valve that cut off the drill pipe and closes the wellbore.        Drilling spool used to connect the choke line and the kill line.        
An LMRP (Lower Marine Riser Package) (2) is mounted at the lower end of a marine riser (3), and is used to connect to the subsea BOP stack. The LMRP (2) has a stack of valves to control the opening and closing of the lower end of the marine riser (3).
In drilling operations the well is typically drilled by a rotating drill string lowered from the drilling rig through the marine riser (3). The drill string is hollow and comprises a series of connected drill pipe sections. Drilling mud is pumped down through the drilling string and out through the drill bit at the bottom of the well and out into the annular space in the borehole. The mud then flows back up to the rig through the annulus, which is the room between the drill string and the outer wall of the well, and back through the subsea BOP, and normally up through the drilling riser, and is returned to the floating installation (4).
The marine riser (3) is a relatively flexible pipe that forms a connection from the drilling floor on the rig to the subsea BOP mounted on the seafloor. The riser contains the drill string and the drilling mud returning through the annulus.
Deepwater drilling is typically done from floating vessels like a ship or a floating rig. Such floating vessels may be anchored, but for deep water the currently dominating practice is to use dynamic positioning where the floating vessel is kept in the desired position by a dynamic positioning system, which is a computer system that records the position as measured by position reference systems such as GPS receivers, taut-wires or hydro-acoustic systems.
ROV (Remotely Operated Vehicles) are underwater vessels with cameras and robotic arms, and a series of sensors such as pressure and heading sensors. ROV's are controlled and operated from the surface through a cable that supplies electrical energy and command signals to the ROV, and transfers camera images and sensor signals back to the surface.
Shallow water control systems may use a hydraulic system for signal transmission. Functions are activated using hydraulic fluid to activate the pilot on a pod, or control system valve. This solution can be used for water depths up to 5000 ft.
MUX (MUltipleXed) BOP control systems are commonly used for drilling at water depths over 3500 feet. In MUX BOP control systems electrical signals are transmitted from the platform to the BOP. Such systems typically use PLC's (Programmable Logic Controllers) on the platform that communicated with subsea electronics contained in water-tight pods on the subsea BOP. Such solution allow for the programming of logics functions and automatic sequencing of operations. Redundant hardware is used to improve reliability.
In addition the BOP control system will have Emergency BOP Control Capabilities, also called secondary intervention systems, which are activated automatically. This may include:                A so-called “Deadman” system is installed on the BOP independently from the subsea control systems and provides signals to shut in the wellbore without operator involvement in response to loss of communication with the surface.        Automatic Mode Function system that runs on the subsea pods or the subsea control systems and shuts in the wellbore without operator involvement in response to loss of communication with the surface.        Automatic shear functions        EDS (Emergency Disconnect System) is used on dynamically positioned rigs. The EDS is activated by the operator by pushing a button. The subsea BOP will then automatically go through a sequence of operations to prepare for the safe disconnection of the LMRP (2) from the subsea BOP. This may include the closing of the kill and choke valves, and the closing of the shear ram to cut the drill string.        
Redundancy is used to improve reliability. At the same time redundancy increases the complexity of the in the computer system, and this may cause problems if this in turn leads to software or hardware errors because of a complicated design.
Interaction of secondary intervention systems that may be designed to do similar functions is another source of errors.
Disconnect of the LMRP (2) may reduce the hydrostatic mud weight on the wellhead (5), which may cause influx of formation fluids, that can lead to an undesired development of the well that can lead to a blow-out.
US patent application US 2009/0101350 A1 describes a system and method to allow backup or alternate fluid flow routes around malfunctioning components using removable, modular component sets. In one exemplary embodiment, an ROV establishes a backup hydraulic flow to a BOP function by attaching one end of a hose to a modular valve block and the other end to an intervention shuttle valve, thus circumventing and isolating malfunctioning components.
US Patent application 2008/0257559 A1 describes a hybrid process control system including electrical transmission of power to a sub-sea hydraulic power unit, which in turn provides hydraulic power for control of hydraulic actuators. A circulation system using small bore tubing in the umbilical cord in combination with a traditional topside hydraulic power unit provides for active control of hydraulic fluid quality with respect to contamination caused by the sub-sea hydraulic actuators, especially process gas from down hole safety valves.
US patent application 2008/0185143 A1 describes a method and apparatus for testing a blowout preventer (BOP) wherein a pressurization unit applies fluid to an isolated portion of the throughbore of the BOP. A signal that is representative of the actual pressure in the isolated portion of the throughbore over successive time points and a pre-determined non-deterministic finite state automaton are used to predict the pressure in the isolated portion of the throughbore as a function of time relative to a pre-determined acceptable leak rate and the time at which stability is achieved.
International patent application WO2008127125 A2 discloses a hardware in the loop test system and test method for testing drilling control systems.
U.S. Pat. No. 4,935,886 A1 discloses a plant control system having a plant operation simulator, including an actual plant operation control system and a controller for controlling a simulation of a plant operation in a state that at least a partial function of the actual plant operation control system is off-line.
US2007100478 A1 discloses a system for testing whether a control system is capable of detection and handling of faults, failures or failure modes in a petroleum process plant.
BOP control systems based on MUX technology depend on proper functioning of a number of computer systems and the interfacing of these systems through interface electronics and communication cables. The BOP control systems go through extensive testing in connection with the Factory Acceptance Test (FAT) and in connection with commissioning during installation at the rig.
Existing test methods involves running through different operator commands to see if the BOP control system performs the specified functions. Moreover, some failure situations can be set up to verify that the BOP control system can handle such failure situations.